|
| 1 | +From e90a255e55e3af0effac927ccaa10c2662501e1a Mon Sep 17 00:00:00 2001 |
| 2 | +From: Lennart Poettering <lennart@poettering.net> |
| 3 | +Date: Wed, 21 Feb 2024 14:43:42 +0100 |
| 4 | +Subject: [PATCH] pcrlock: handle measurement logs where hash algs in header |
| 5 | + are announced in different order than in records |
| 6 | + |
| 7 | +Apparently on HyperV the measurement logs announce the hash algs in a |
| 8 | +different order in the header than the records have them. Let's handle |
| 9 | +this gracefully |
| 10 | +--- |
| 11 | + src/pcrlock/pcrlock.c | 21 ++++++++++++++------- |
| 12 | + 1 file changed, 14 insertions(+), 7 deletions(-) |
| 13 | + |
| 14 | +diff --git a/src/pcrlock/pcrlock.c b/src/pcrlock/pcrlock.c |
| 15 | +index e70c44c6..1fb9d692 100644 |
| 16 | +--- a/src/pcrlock/pcrlock.c |
| 17 | ++++ b/src/pcrlock/pcrlock.c |
| 18 | +@@ -936,23 +936,30 @@ static int event_log_load_firmware(EventLog *el) { |
| 19 | + assert(event->digests.count == n_algorithms); |
| 20 | + |
| 21 | + for (size_t i = 0; i < n_algorithms; i++, ha = ha_next) { |
| 22 | +- ha_next = (const uint8_t*) ha + offsetof(TPMT_HA, digest) + algorithms[i].digestSize; |
| 23 | +- |
| 24 | + /* The TPMT_HA is not aligned in the record, hence read the hashAlg field via an unaligned read */ |
| 25 | + assert_cc(__builtin_types_compatible_p(uint16_t, typeof(TPMI_ALG_HASH))); |
| 26 | + uint16_t hash_alg = unaligned_read_ne16((const uint8_t*) ha + offsetof(TPMT_HA, hashAlg)); |
| 27 | + |
| 28 | +- if (hash_alg != algorithms[i].algorithmId) |
| 29 | +- return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Hash algorithms in event log record don't match log."); |
| 30 | ++ /* On some systems (some HyperV?) the order of hash algorithms announced in the |
| 31 | ++ * header does not match the order in the records. Let's hence search for the right |
| 32 | ++ * mapping */ |
| 33 | ++ size_t j; |
| 34 | ++ for (j = 0; j < n_algorithms; j++) |
| 35 | ++ if (hash_alg == algorithms[j].algorithmId) |
| 36 | ++ break; |
| 37 | ++ if (j >= n_algorithms) |
| 38 | ++ return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Hash algorithms in event log record not among those advertised by log header."); |
| 39 | ++ |
| 40 | ++ ha_next = (const uint8_t*) ha + offsetof(TPMT_HA, digest) + algorithms[j].digestSize; |
| 41 | + |
| 42 | +- if (!tpm2_hash_alg_to_string(algorithms[i].algorithmId)) |
| 43 | ++ if (!tpm2_hash_alg_to_string(hash_alg)) |
| 44 | + continue; |
| 45 | + |
| 46 | + r = event_log_record_add_bank( |
| 47 | + record, |
| 48 | +- algorithms[i].algorithmId, |
| 49 | ++ hash_alg, |
| 50 | + (const uint8_t*) ha + offsetof(TPMT_HA, digest), |
| 51 | +- algorithms[i].digestSize, |
| 52 | ++ algorithms[j].digestSize, |
| 53 | + /* ret= */ NULL); |
| 54 | + if (r < 0) |
| 55 | + return log_error_errno(r, "Failed to add bank to event log record: %m"); |
| 56 | +-- |
| 57 | +2.45.4 |
| 58 | + |
0 commit comments